2012 04 ghackmysql pdf

(1)

White-hat Google-Hacking MySQL

Sheeri Cabral

(2)

What is

White-Hat Google Hacking?

Hacking

Using Google

(3)

Where to Start

Do some searching

(4)

Security Advisories

App and Web servers

Applications

(5)

Google's TOS

Under 18?

No automation

What's not in the TOS

https://www.google.com/accounts/TOS

(6)

Password Hashes

Hash Dictionaries like http://hashash.in/

Password hash is

*13824B0ECE00B527531D2C716AD36C23AC11A30B

(7)

How to Use Google

wildcards * .

Different media types

(8)

Google Basics

10 word limit

AND assumed

(9)

Operators

http://www.google.com/help/operators.html

/cheatsheet.html

Site matters

filetype: vs inurl:

(10)

(11)

Vulnerable Locations

Common paths

(12)

Some To Try

inurl:config.php inurl:php?

inurl:delete inurl:delete.php?id=

link:private.yourcompany.com

(13)

More To Try

site:sheeri.com filetype:php inurl:id

- Then test out injection

http://:@www.sheeri.com

(14)

Further study

http://bit.ly/ghacks0

http://bit.ly/ghacks1

(15)

Defensive Strategies

Validate/scrub input

CSRF – Validate source

XSS

SQL Injection Cheat Sheet

(16)

(17)

SQL Injection



http://bit.ly/explainsqlinj

SELECT count(*) FROM users WHERE

(18)

SQL Injection



http://bit.ly/explainsqlinj

SELECT count(*) FROM users WHERE

username='$user' and pass='$pass';

-- if count(*)>0, log in!



Pass: hi' or 1=1

SELECT count(*) FROM users WHERE

(19)

Validate User Input



Look for ; \g \G ' “ UNION



HTML encoding



NULL or char(0)

(20)

Validate User Input



Save yourself time



Buffer overflows

(21)

Trusting GET or POST



Only from certain pages



cookies – even with valid session ids

(22)

When, Not If

How is application DB access stored?

As strong as your weakest link

(23)

Regression Testing Tools

http://sites.google.com/site/murfie/

–

_goolink

–

_crapscan

(24)

More Actions

Google Hacking Software

–

_{http://code.google.com/p/googlehacks/}

Google Hacks Honey Pot

–

_{http://ghh.sourceforge.net/}

(25)

Vulnerability Checking Tools

Goolag.org – GUI – old, but open source

(26)

Questions? Comments?

OurSQL podcast

- www.oursql.com

MySQL Administrator's Bible

- tinyurl.com/mysqlbible

(27)

White-hat Google-Hacking MySQL

Sheeri Cabral

(28)

What is

White-Hat Google Hacking?

Hacking

Using Google

White-hat

By “hacking” I mean poking around to see if your site has security vulnerabilities.

Google hacking uses Google to research. For instance, if your site runs “wordpress”, you can search for:

wordpress security vulnerability exploit

site:sheeri.com wordpress

White hat – meaning the good, legal kind.

(29)

Where to Start

Do some searching

http://johnny.ihackstuff.com/ghdb

Sometimes it helps to see what's already out there.

info:www.sheeri.com

Go to:

http://johnny.ihackstuff.com/ghdb/

click on “error messages”

Show a few

(30)

Security Advisories

App and Web servers

Applications

Companies

Note that you'll be searching your site only, but hackers will be searching for specific vulnerabilities.

site:sheeri.com "powered by wordpress"

(31)

Google's TOS

Under 18?

No automation

What's not in the TOS

https://www.google.com/accounts/TOS

- past versions

If you're under 18, please don't use Google. (although they have the magic clause 20.5 – if one part is bad the rest of the contract is still good)

Section 4.5 – number of transmissions or data storage – so if you're automating searches and retrievals, you want to throttle yourself

Section 5.3 -- don't even try to automate!

What's not in the TOS -- “don't break laws using Google's services”. That being said....don't!

(32)

Password Hashes

Hash Dictionaries like http://hashash.in/ Password hash is

*13824B0ECE00B527531D2C716AD36C23AC11A30B

What is the password in plaintext?

If you're under 18, please don't use Google. (although they have the magic clause 20.5 – if one part is bad the rest of the contract is still good)

Section 4.5 – number of transmissions or data storage – so if you're automating searches and retrievals, you want to throttle yourself

Section 5.3 -- don't even try to automate!

What's not in the TOS -- “don't break laws using Google's services”. That being said....don't!

(33)

How to Use Google

wildcards * .

Different media types

Boolean search

* is 1 word missing, . Is 1 character.

Not bad, because Google automatically does the stemming you want (ie, database vs databases)

different media types – blog search vs. news search, etc.

(34)

Google Basics

10 word limit

AND assumed

foo | bar

Foo bar searches for “foo” and “Bar”

(35)

Operators

http://www.google.com/help/operators.html /cheatsheet.html Site matters

filetype: vs inurl:

Google Dork

http://www.google.com/help/operators.html

we already mentioned site: site:sheeri.com viagra

site:www.sheeri.com viagra site:sheeri.net viagra (same) site: sheeri.org viagra

So try out all your domains -- I can't use “inurl:sheeri” inurl:sheeri viagra

You can do “Filetype:” for php files, html, jsp, etc but can also use “inurl”

(36)

(37)

Vulnerable Locations

Common paths

Open source = double-edged sword

(38)

Some To Try

inurl:config.php inurl:php?

inurl:delete inurl:delete.php?id=

link:private.yourcompany.com

numrange:

site:www.sheeri.com inurl:config.php site:www.sheeri.com inurl:admin.php site:www.sheeri.com inurl:"php?"

shows variables

inurl:delete – if you're sending the actions with a GET variable, that's bad! There's also delete.php

is there a site that is linking where it shouldn't?

(39)

More To Try

site:sheeri.com filetype:php inurl:id - Then test out injection

http://*:*@www.sheeri.com

intitle:Remote.Desktop.Web.Connection site:sheeri.com

5) "site:<your site> filetype:php inurl:id" - By searching for files of type php, you can sometimes find

applications that are accepting parameters by looking for "id" in the URL. Then, use a trick I got from Erratasec,

replace the fields with ' and find many SQL injection vulnerabilities.

(40)

Further study

http://bit.ly/ghacks0 http://bit.ly/ghacks1

www.securityvulns.com

5) "site:<your site> filetype:php inurl:id" - By searching for files of type php, you can sometimes find

applications that are accepting parameters by looking for "id" in the URL. Then, use a trick I got from Erratasec,

replace the fields with ' and find many SQL injection vulnerabilities.

(41)

Defensive Strategies

Validate/scrub input

CSRF – Validate source

XSS

SQL Injection Cheat Sheet

– http://bit.ly/sqlinjcheat

Only use what's needed, to avoid query injection, and use prepared

statements when possible, you can also now use them in conjunction with stored procedures so the query is handled by the db code, instead of

having the developers write code.

This doesn't help when someone goes through and pulls up account information for customer 1, customer 2, etc (or deletes them). That is CSRF – Cross Site Request Forgery -- uses completely valid requests.

To defend against that, referer checking (hackable) or validation tokens (for site and for permission—do not think “if they got to this page they can execute the code”—re-validate if necessary)

XSS = cross-site scripting, ie using a form for SQL injection.

(42)

(43)

SQL Injection

 http://bit.ly/explainsqlinj

SELECT count(*) FROM users WHERE username='$user' and pass='$pass'; -- if count(*)>0, log in!

I'm not going to talk much about SQL injection, but I'll give an overview:

(44)

SQL Injection

 http://bit.ly/explainsqlinj

SELECT count(*) FROM users WHERE username='$user' and pass='$pass'; -- if count(*)>0, log in!

 Pass: hi' or 1=1

SELECT count(*) FROM users WHERE

username='foo' and pass='hi' or 1=1';

I'm not going to talk much about SQL injection, but I'll give an overview:

(45)

Validate User Input

 Look for ; \g \G ' “ UNION

 HTML encoding

 NULL or char(0)

 VARCHAR and ' '

Disallow or escape ; \g \G “ ' UNION (; won't always help, check if multi_query is allowed) XSS - Do you allow HTML in stored forms? Including javascript? Personal ad and <G> in form renders weird. Not to mention <SCRIPT .... folks put links to their pay-per-click ads, whenever their page is clicked...

Type 0 XSS -- ?? page's client-side script, ie javascript, access URL request and uses info on that page for something in the current page, can be exploited – can put in another script.

Type 1 XSS – server gets data from client, client can put scripts in there. Reason to strip out HTML

Type 2 XSS – when this stuff is stored.

(46)

Validate User Input

 Save yourself time

 Buffer overflows

 CHARSET

Save yourself time, include e-mail checks if you can (php checkdnsrr) Buffer overflows

(47)

Trusting GET or POST

 Only from certain pages

 cookies – even with valid session ids

 register_globals=off in PHP

Easy to copy your web form and send it

HIDDEN fields too all you have to do is view source!

Valid user can do bad stuff, so even with a session ID don't trust unless it's your site register_globals off in php to avoid POST params in GET context

index.php?$auth=true Buffer overflows

(48)

When, Not If

How is application DB access stored?

As strong as your weakest link

No vaccine

And that weak link might be someone putting passwords on an intranet wiki they didn't realize was being searched by google!

(49)

Regression Testing Tools

http://sites.google.com/site/murfie/

– goolink – crapscan – goohosts

Goolink -- parse all the hyperlinks in a saved google search results page so they can be downloaded with 1 command (wget -i results.html) or they can be used with other scripts (hostlookup etc..)

Crapscan – searches for certain files in a URL tree. You can customize the files, like “apache_log” -- for regression testing

(50)

More Actions

Google Hacking Software

– http://code.google.com/p/googlehacks/

Google Hacks Honey Pot

– http://ghh.sourceforge.net/

Google honors robots.txt

....

use the honey pot to trap people and find them if you have the time.

You can have your pages removed from Google, and Google honors the robots.txt, but most of us don't want that.

(51)

Vulnerability Checking Tools

Goolag.org – GUI – old, but open source

Wikto/Nikto

http://www.goolag.org/specifications.html

Windows, .NET framework. GUI-based, type in a host and a list of things to check. When I installed it voices came up, so be prepared. 10 dorks or less to scan, it doesn't warn, otherwise it does.

Scan for “powered by wordpress” on www.sheeri.com

Web server assessment tools.

http://www.sensepost.com/research/wikto/

(52)

Questions? Comments?

OurSQL podcast

- www.oursql.com

MySQL Administrator's Bible - tinyurl.com/mysqlbible